[AUTO-INF-5] `build` and `helm` CI jobs have no `needs` dependencies — run in parallel with quality gates wasting resources on failing code #10240

New issue

Open

opened 2026-04-17 10:07:16 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-17 10:07:16 +00:00

Owner

Metadata

Commit message: fix(ci): add quality gate needs dependencies to build and helm jobs in ci.yml
Branch name: fix/auto-inf-5-build-helm-missing-needs-deps

Background and Context

In .forgejo/workflows/ci.yml, the build and helm jobs have no needs declarations, meaning they run in parallel with lint, typecheck, security, and quality from the very start of every CI run. This wastes runner resources by building artifacts and validating Helm charts for code that may fail basic quality checks.

Current state in ci.yml:

build:
    runs-on: docker
    # No needs: — runs in parallel with everything from the start

helm:
    runs-on: docker
    # No needs: — runs in parallel with everything from the start

As documented in issue #9783's pipeline overview, both build and helm have Depends On: — (nothing). This means:

If lint fails (e.g., a syntax error), the build job still runs and builds a broken wheel
If typecheck fails, the helm job still validates charts for type-incorrect code
CI resources (Docker runner time, network bandwidth for Helm/kubeconform downloads) are consumed even when the code would be rejected by fast quality checks

The helm job downloads Helm v3.16.4 and kubeconform v0.7.0 on every run (~30–90 seconds of download time) regardless of whether the code passes basic quality gates. The build job builds a Python wheel that may be immediately discarded when lint or typecheck fails.

Expected Behavior

The build and helm jobs should only run after the fast quality gate jobs (lint, typecheck, security, quality) have passed successfully:

build:
    needs: [lint, typecheck, security, quality]
    runs-on: docker
    # ... existing steps unchanged

helm:
    needs: [lint, typecheck]
    runs-on: docker
    # ... existing steps unchanged

This ensures:

No wheel is built for code that fails lint or typecheck
No Helm chart validation is run for code that fails basic quality checks
Runner resources are conserved when fast checks catch issues early

Acceptance Criteria

The build job in .forgejo/workflows/ci.yml has needs: [lint, typecheck, security, quality]
The helm job in .forgejo/workflows/ci.yml has needs: [lint, typecheck] (at minimum)
A CI run where lint fails causes build and helm to be skipped/not started
A CI run where typecheck fails causes build and helm to be skipped/not started
No circular dependencies are introduced in the job graph
The status-check aggregator job still correctly aggregates all job results
All existing CI jobs continue to function correctly after the dependency update

Subtasks

Audit .forgejo/workflows/ci.yml for the build job definition and add needs: [lint, typecheck, security, quality]
Audit .forgejo/workflows/ci.yml for the helm job definition and add needs: [lint, typecheck]
Verify the updated dependency graph does not create circular dependencies
Confirm status-check still correctly depends on both build and helm
Test the fix by triggering a CI run with a deliberate lint failure to confirm build and helm are skipped
Review whether helm should also depend on security and quality (optional enhancement)

Definition of Done

This issue should be closed when:

Both build and helm jobs have appropriate needs declarations in .forgejo/workflows/ci.yml
A failing lint or typecheck job provably prevents build and helm from starting
The fix is merged to the main branch via a PR that passes all required CI checks
No regression in the CI pipeline's ability to detect and report failures

Duplicate Check

Check	Query / Source	Result
Check 1	Open issues pages 1–7 searched for `build job`, `helm job`, `helm needs`, `build needs`	No existing issue specifically addresses `build` and `helm` jobs having no `needs` dependencies
Check 2	Closed issues pages 1–6 searched for same keywords	No matches found
Check 3	Cross-area: #10067 "Add missing job dependencies in CI pipeline"	Covers `coverage` and `docker` job dependencies only — does NOT mention `build` or `helm` jobs
Check 4	Cross-area: #9767 "Harden CI workflow reliability"	Mentions helm in broader re-tiering proposal (P3.1) but does not specifically call out `build` job or provide actionable fix
Check 5	Cross-area: #9783 "Reduce CI execution time"	Documents `build` and `helm` as having no dependencies in pipeline overview but proposes path-gating (P2.2), not quality-gate dependencies — distinct fix
Known issues list	Reviewed all 9 known existing issues	None cover `build`/`helm` missing `needs` as a standalone actionable fix

Conclusion: No duplicate found. This is a genuinely new, specific, actionable finding.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure Pool | Agent: test-infra-pool-supervisor

## Metadata - **Commit message:** `fix(ci): add quality gate needs dependencies to build and helm jobs in ci.yml` - **Branch name:** `fix/auto-inf-5-build-helm-missing-needs-deps` ## Background and Context In `.forgejo/workflows/ci.yml`, the `build` and `helm` jobs have no `needs` declarations, meaning they run in parallel with `lint`, `typecheck`, `security`, and `quality` from the very start of every CI run. This wastes runner resources by building artifacts and validating Helm charts for code that may fail basic quality checks. **Current state in ci.yml:** ```yaml build: runs-on: docker # No needs: — runs in parallel with everything from the start helm: runs-on: docker # No needs: — runs in parallel with everything from the start ``` As documented in issue #9783's pipeline overview, both `build` and `helm` have `Depends On: —` (nothing). This means: - If `lint` fails (e.g., a syntax error), the `build` job still runs and builds a broken wheel - If `typecheck` fails, the `helm` job still validates charts for type-incorrect code - CI resources (Docker runner time, network bandwidth for Helm/kubeconform downloads) are consumed even when the code would be rejected by fast quality checks The `helm` job downloads Helm v3.16.4 and kubeconform v0.7.0 on every run (~30–90 seconds of download time) regardless of whether the code passes basic quality gates. The `build` job builds a Python wheel that may be immediately discarded when lint or typecheck fails. ## Expected Behavior The `build` and `helm` jobs should only run after the fast quality gate jobs (`lint`, `typecheck`, `security`, `quality`) have passed successfully: ```yaml build: needs: [lint, typecheck, security, quality] runs-on: docker # ... existing steps unchanged helm: needs: [lint, typecheck] runs-on: docker # ... existing steps unchanged ``` This ensures: - No wheel is built for code that fails lint or typecheck - No Helm chart validation is run for code that fails basic quality checks - Runner resources are conserved when fast checks catch issues early ## Acceptance Criteria - [ ] The `build` job in `.forgejo/workflows/ci.yml` has `needs: [lint, typecheck, security, quality]` - [ ] The `helm` job in `.forgejo/workflows/ci.yml` has `needs: [lint, typecheck]` (at minimum) - [ ] A CI run where `lint` fails causes `build` and `helm` to be skipped/not started - [ ] A CI run where `typecheck` fails causes `build` and `helm` to be skipped/not started - [ ] No circular dependencies are introduced in the job graph - [ ] The `status-check` aggregator job still correctly aggregates all job results - [ ] All existing CI jobs continue to function correctly after the dependency update ## Subtasks - [ ] Audit `.forgejo/workflows/ci.yml` for the `build` job definition and add `needs: [lint, typecheck, security, quality]` - [ ] Audit `.forgejo/workflows/ci.yml` for the `helm` job definition and add `needs: [lint, typecheck]` - [ ] Verify the updated dependency graph does not create circular dependencies - [ ] Confirm `status-check` still correctly depends on both `build` and `helm` - [ ] Test the fix by triggering a CI run with a deliberate lint failure to confirm `build` and `helm` are skipped - [ ] Review whether `helm` should also depend on `security` and `quality` (optional enhancement) ## Definition of Done This issue should be closed when: 1. Both `build` and `helm` jobs have appropriate `needs` declarations in `.forgejo/workflows/ci.yml` 2. A failing `lint` or `typecheck` job provably prevents `build` and `helm` from starting 3. The fix is merged to the main branch via a PR that passes all required CI checks 4. No regression in the CI pipeline's ability to detect and report failures ### Duplicate Check | Check | Query / Source | Result | |-------|---------------|--------| | Check 1 | Open issues pages 1–7 searched for `build job`, `helm job`, `helm needs`, `build needs` | No existing issue specifically addresses `build` and `helm` jobs having no `needs` dependencies | | Check 2 | Closed issues pages 1–6 searched for same keywords | No matches found | | Check 3 | Cross-area: #10067 "Add missing job dependencies in CI pipeline" | Covers `coverage` and `docker` job dependencies only — does NOT mention `build` or `helm` jobs | | Check 4 | Cross-area: #9767 "Harden CI workflow reliability" | Mentions helm in broader re-tiering proposal (P3.1) but does not specifically call out `build` job or provide actionable fix | | Check 5 | Cross-area: #9783 "Reduce CI execution time" | Documents `build` and `helm` as having no dependencies in pipeline overview but proposes path-gating (P2.2), not quality-gate dependencies — distinct fix | | Known issues list | Reviewed all 9 known existing issues | None cover `build`/`helm` missing `needs` as a standalone actionable fix | **Conclusion:** No duplicate found. This is a genuinely new, specific, actionable finding. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure Pool | Agent: test-infra-pool-supervisor

HAL9000 added the

labels

2026-04-17 10:27:49 +00:00

HAL9000 referenced this issue

2026-04-17 11:22:32 +00:00

[AUTO-INF-POOL] Status: Test Infrastructure Pool (Cycle 4) #10206